Database Info

How to enter radio bootloader (OEMSBL)

Most of you know how to enter the "normal" SPL bootloader where the famous tri-color screen is shown on the device display: if the device is powered off you press and hold the camera button and then press power on.
What most of you don't know is that there is also a radio bootloader aka OEMSBL. The OEMSBL is loaded just before the SPL. Just like the SPL it supports a interactive command mode with various commands. The command set available depends on the security state of your device. The most interesting command available in both states is "radata" which is normally used to flash a new radio rom. Perhaps it can be used for unbricking purposes. I will continue to research this.
(EDIT: unfortunately to enter radio bootloader by keypressing only works on security unlocked devices)
To enter radiobootloader mode:
if the device is powered off you press and hold the camera button *and* the send button and then press power on.
If it is the first time you enter this mode Windows will prompy you to install 3 drivers: a modem and 2 COM ports (diagnostics and NMEA). Use the attched drivers from the Motorola Q (it also has a qualcomm MSM7200 chipset). Look in device manager on which COM port the diagnostics port driver sits (usually COM4 or COM5). Then start MTTY and connect to that COM port. The commands you type are not echoed on your PC screen.
On a standard device (not security unlocked) following commands are supported:
Code:
radata
powerdown
setboot
GO2AMSS
rseed
pmic_vib_off
pmic_vreg
pmic_level
pmic_vib_on
rpass
On a security unlocked device (see here) there is much more:
Code:
For a help screen, use command ? or h
Available monitor commands are:
? [command]
h [command]
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
setboot [0/1/2/3]
setatcmd [0:SIO/1:UART/2:USB/3:DPRAM]
setsmdloop [0:disable/1:enable]
setmpatch [0x1: CPU Freq/0x2: acoustic/0x4: simdoor/0x8: RTC]
setiot [0:Disable/1:Enable]
eraseall [erase all setting flags]
setdiag [0:USB/1:UART/2:DPRAM/3:SIO]
partition
checksum
format
setinfo
readadc
cego
setgpio
getgpio
gpio
version
powerdown
platformid
radata
showexplog [n]
usbdppulldown [n]
usbdmpulldown [n]
usbdppullup [n]
usbdmpullup [n]
Headsetpullhigh [n]
rfid
wpmic [PM_VREG] [0/1]

Damn, didn't know this.

xmoo said:
Damn, didn't know this.
Click to expand...
Click to collapse
I would like someone with a standard Kaiser to confirm that it is possible to enter radio bootloader. My Kaiser is security unlocked and perhaps it only works in that case ...

I tried twice with my kaiser, not security unlocked. Got nothing.

xconradx said:
I tried twice with my kaiser, not security unlocked. Got nothing.
Click to expand...
Click to collapse
Thanks for testing, I've edited my first post.
What's written in the first post is just dry theory for most of you guys

to access the OEMSBL usb/serial devices in linux, you need the airprime driver which is present in mainline kernel (CONFIG_USB_SERIAL_AIRPRIME).
In the distribution I use (ubuntu) it is present as module and udev automatically loads it when kaiser is attached via usb while in OESMBL. It creates nine serial devices. In my case /dev/ttyUSB3 is the arm9 debugger.
Did somebody try the modem interface? I only get data from the arm9 debug interface.
I can confirm xconradx's finding that it is not possible to enter OESMBL while kaiser is not security enabled.
thanks a lot for the great tools!
edit: I used minicom to connect with ttyUSB3 with the following settings:
Code:
A - Serial Device : /dev/ttyUSB3
B - Lockfile Location : /var/lock
C - Callin Program :
D - Callout Program :
E - Bps/Par/Bits : 115200 8N1
F - Hardware Flow Control : No
G - Software Flow Control : No

Very interesting. Thanks

How to unlock my ExtROM & Storage?(Huawei C8100,WM6.1p)

I've read all the instructions about configure registry or run unlock tools,but it doesn't work for it.
my device is Huawei C8100(CDMA EVDO),CE 5.2.2.0971(internal version 20971.1.5.4)
here is the registry dump of HLM\System\StorageManager,I trid a tool from http://forum.xda-developers.com/showpost.php?p=1696907&postcount=113,after run the 1st tool and soft-reset,my sd card was hidden and can not view from explorer.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\System\StorageManager]
"PNPWaitIODelay"=dword:00001000
"PNPUnloadDelay"=dword:00001000
"Dll"="fsdmgr.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\Filters]
[HKEY_LOCAL_MACHINE\System\StorageManager\Filters\ENCFilt]
"DeviceGUID"=hex:99,F3,DC,7D,54,04,B6,1A,C6,2E,88,BD,4C,E2,C2,FB
"PolicyDLL"="DeviceEncryptionPolicy.dll"
"EncryptByDefault"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\Filters\fsdspy]
"dll"="fsdspy.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\Filters\fsreplxfilt]
"DirsToExclude"=hex(7):5C,00,6D,00,78,00,69,00,70,00,5F,00,69,00,6E,00,69,00,74,00,64,00,62,\
00,2E,00,76,00,6F,00,6C,00,00,00,5C,00,6D,00,78,00,69,00,70,00,5F,00,73,00,\
79,00,73,00,74,00,65,00,6D,00,2E,00,76,00,6F,00,6C,00,00,00,5C,00,6D,00,78,\
00,69,00,70,00,5F,00,6E,00,6F,00,74,00,69,00,66,00,79,00,2E,00,76,00,6F,00,\
6C,00,00,00,5C,00,6D,00,78,00,69,00,70,00,5F,00,6C,00,61,00,6E,00,67,00,2E,\
00,76,00,6F,00,6C,00,00,00,5C,00,63,00,65,00,6D,00,61,00,69,00,6C,00,2E,00,\
76,00,6F,00,6C,00,00,00,5C,00,70,00,69,00,6D,00,2E,00,76,00,6F,00,6C,00,00,\
00,5C,00,44,00,6F,00,63,00,75,00,6D,00,65,00,6E,00,74,00,73,00,20,00,61,00,\
6E,00,64,00,20,00,53,00,65,00,74,00,74,00,69,00,6E,00,67,00,73,00,5C,00,64,\
00,65,00,66,00,61,00,75,00,6C,00,74,00,5C,00,75,00,73,00,65,00,72,00,2E,00,\
68,00,76,00,00,00,5C,00,44,00,6F,00,63,00,75,00,6D,00,65,00,6E,00,74,00,73,\
00,20,00,61,00,6E,00,64,00,20,00,53,00,65,00,74,00,74,00,69,00,6E,00,67,00,\
73,00,5C,00,73,00,79,00,73,00,74,00,65,00,6D,00,2E,00,68,00,76,00,00,00,5C,\
00,57,00,69,00,6E,00,64,00,6F,00,77,00,73,00,5C,00,50,00,72,00,6F,00,66,00,\
69,00,6C,00,65,00,73,00,5C,00,67,00,75,00,65,00,73,00,74,00,5C,00,54,00,65,\
00,6D,00,70,00,6F,00,72,00,61,00,72,00,79,00,20,00,49,00,6E,00,74,00,65,00,\
72,00,6E,00,65,00,74,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,00,00,5C,\
00,57,00,69,00,6E,00,64,00,6F,00,77,00,73,00,5C,00,50,00,72,00,6F,00,66,00,\
69,00,6C,00,65,00,73,00,5C,00,67,00,75,00,65,00,73,00,74,00,5C,00,43,00,6F,\
00,6F,00,6B,00,69,00,65,00,73,00,5C,00,00,00,5C,00,57,00,69,00,6E,00,64,00,\
6F,00,77,00,73,00,5C,00,50,00,72,00,6F,00,66,00,69,00,6C,00,65,00,73,00,5C,\
00,67,00,75,00,65,00,73,00,74,00,5C,00,48,00,69,00,73,00,74,00,6F,00,72,00,\
79,00,5C,00,00,00,5C,00,57,00,69,00,6E,00,64,00,6F,00,77,00,73,00,5C,00,41,\
00,63,00,74,00,69,00,76,00,65,00,73,00,79,00,6E,00,63,00,5C,00,00,00,5C,00,\
77,00,69,00,6E,00,64,00,6F,00,77,00,73,00,5C,00,6D,00,65,00,73,00,73,00,61,\
00,67,00,69,00,6E,00,67,00,5C,00,00,00,5C,00,54,00,65,00,6D,00,70,00,5C,00,\
00,00,5C,00,57,00,69,00,6E,00,64,00,6F,00,77,00,73,00,5C,00,53,00,79,00,73,\
00,74,00,65,00,6D,00,5C,00,50,00,75,00,73,00,68,00,52,00,6F,00,75,00,74,00,\
65,00,72,00,5C,00,63,00,6C,00,69,00,65,00,6E,00,74,00,71,00,75,00,65,00,75,\
00,65,00,73,00,2E,00,76,00,6F,00,6C,00,00,00,5C,00,50,00,72,00,6F,00,67,00,\
72,00,61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,00,00,00,00
"NumDirsToExclude"=dword:00000010
"ReplStoreCacheSize"=dword:00000000
"ReplStoreDoImmaculate"=dword:00000000
"ReplStoreName"="ReplStor"
"ReplStorePath"="\\ReplStorVol"
"ReplStoreHostVolume"=""
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad]
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\Relfsd]
"BootPhase"=dword:00000002
"MountFlags"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\NANDDISK]
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BlockDevice\\NANDDISK"
"BootPhase"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\ExtFlash]
"Order"=dword:00000000
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BuiltIn\\ExtFlash"
"BootPhase"=dword:00000002
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\MSFlash]
"Order"=dword:00000000
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BuiltIn\\MSFlash"
"BootPhase"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\RAMFMD]
"BootPhase"=dword:00000001
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BlockDevice\\RAMFMD"
[HKEY_LOCAL_MACHINE\System\StorageManager\FATFS]
"Flags"=dword:00000044
"CacheDll"="diskcache.dll"
"Util"="fatutil.dll"
"CacheSize"=dword:00000000
"EnableCache"=dword:00000001
"Paging"=dword:00000001
"Dll"="fatfsd.dll"
"FriendlyName"="FAT FileSystem"
[HKEY_LOCAL_MACHINE\System\StorageManager\FATFS\Filters]
[HKEY_LOCAL_MACHINE\System\StorageManager\FATFS\Filters\ENCFilt]
"Dll"="mencfilt.dll"
"Order"=dword:00000005
[HKEY_LOCAL_MACHINE\System\StorageManager\FATFS\Filters\CacheFilt]
"Dll"=""
"Order"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\HRFFS]
"Dll"="hrffs1.dll"
"FriendlyName"="HRFFS FileSystem"
[HKEY_LOCAL_MACHINE\System\StorageManager\PartitionTable]
"26"="BINARY"
"25"="IMGFS"
"23"="RAWFS"
"22"="RAWFS"
"21"="BINFS"
"20"="BOOT"
"0F"="FATFS"
"0E"="FATFS"
"0C"="FATFS"
"0B"="FATFS"
"07"="NTFS"
"06"="FATFS"
"04"="FATFS"
"01"="FATFS"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles]
"Folder"="已装入的卷"
"PartitionDriverName"="MSPART"
"DefaultFileSystem"=""
"MountFlags"=dword:00000000
"AutoFormat"=dword:00000000
"AutoPart"=dword:00000000
"AutoMount"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\PCMCIA]
"Folder"="存储卡"
"Name"="PCMCIA/Compact Flash Device"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\HDProfile]
"Folder"="硬盘"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\SDMMC]
"Folder"="存储卡"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\SDMemory]
"Folder"="Storage Card"
"Name"="SD Memory Card"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\SDMemory\FATFS]
"Flags"=dword:00000064
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\SDMemory\FATFS\Filters]
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\SDMemory\FATFS\Filters\ENCFilt]
"Dll"="encfilt.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MMC]
"Name"="MMC Card"
"Folder"="MMC Card"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MMC\FATFS]
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MMC\FATFS\Filters]
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MMC\FATFS\Filters\ENCFilt]
"Dll"="encfilt.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\HRFFS]
"DefaultFileSystem"="HRFFS"
"PartitionDriver"="mspart.dll"
"AutoPart"=dword:00000001
"AutoFormat"=dword:00000001
"CheckForFormat"=dword:00000001
"Folder"="HRFFS"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\HRFFS\PartitionTable]
"34"="HRFFS"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash_DDRRAM]
"AutoFormat"=dword:00000001
"AutoPart"=dword:00000001
"Folder"="DDR Disk"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash_DDRRAM\FATFS]
"FormatTfat"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ExtFlash]
"PartitionDriver"="mspart.dll"
"MountAsROM"=dword:00000001
"MountHidden"=dword:00000001
"Folder"="Extended_ROM"
"Name"="FLASH Disk Block Device"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ExtFlash\FATFS]
"MountAsROM"=dword:00000000
"MountHidden"=dword:00000000
"Flags"=dword:00000004
"CheckForFormat"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash_RAMFMD]
"DefaultFileSystem"="HRFFS"
"PartitionDriver"="mspart.dll"
"CheckForFormat"=dword:00000001
"Folder"="Disk"
"AutoFormat"=dword:00000001
"AutoPart"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash_RAMFMD\PartitionTable]
"34"="HRFFS"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\USBCDProfile]
"Folder"="光盘驱动器"
"PartitionDriver"=""
"DefaultFileSystem"="UDFS"
"Name"="USB CDROM/DVD Drive"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\USBCDProfile\PartitionTable]
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\USBFDProfile]
"Folder"="软盘驱动器"
"PartitionDriver"=""
"DefaultFileSystem"="FATFS"
"Name"="USB Floppy Disk Drive"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\USBHDProfile]
"Folder"="硬盘"
"Name"="USB Hard Disk Drive"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\USBHDProfile\FATFS]
"EnableCacheWarm"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\CDProfile]
"Folder"="光盘驱动器"
"PartitionDriver"=""
"DefaultFileSystem"="UDFS"
"Name"="IDE CDROM/DVD Drive"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\CDProfile\PartitionTable]
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash]
"Name"="FLASH Disk Block Device"
"Folder"="Flash Disk"
"MountHidden"=dword:00000001
"MountAsROM"=dword:00000001
"PartitionDriver"="mspart.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash\IMGFS]
"XIP"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash\FATFS]
"Flags"=dword:00600014
"EnableWriteBack"=dword:00000001
"MountAsRoot"=dword:00000001
"MountAsBootable"=dword:00000001
"DataCacheSize"=dword:00000800
"FatCacheSize"=dword:00000200
"CheckForFormat"=dword:00000001
"FormatTfat"=dword:00000001
"MountHidden"=dword:00000000
"MountAsROM"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash\FATFS\Filters]
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash\FATFS\Filters\fsreplxfilt]
"Order"=dword:00000001
"Dll"="fsreplxfilt.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\MSPART]
"Dll"="mspart.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\IMGFS]
"ShadowROM"=dword:00000001
"Paging"=dword:00000001
"Dll"="imgfs.dll"
"FriendlyName"="Image-Update Filesystem"

Wrong forum
Welcome to forums
We dedicate here only to HTC devices, so you won´t find too much attention.
Better to try in other fora
Good luck,

[Q] How to unhide system folders in my PNA?

I have a PNA that has system hidden folders (such as ResidentFlash and ResidentFlash2).
I want to unhide those folder, so I could see them normally in TotalCommander.
I've tried to change the registry values of the StorageManager profiles - but seems that nothing have changed.
I've changed all the "MountHidden" values under [HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\FlashDrv] to 0, still nor ResidentFlash niether ResidentFlash2 appear in TotalCommander.
I've attached the relevant registry values, so you can observe them:
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\System\StorageManager]
"Dll"="fsdmgr.dll"
"PNPUnloadDelay"=dword:00000100
"PNPWaitIODelay"=dword:000009C4
[HKEY_LOCAL_MACHINE\System\StorageManager\BinFS]
"MountHidden"=dword:00000000
"FriendlyName"="Bin FileSystem"
"DLL"="binfs.dll"
"Paging"=dword:00000001
"Folder"="BINFS"
"MountAsROM"=dword:00000001
"MountPermanent"=dword:00000001
"BootPhase"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles]
"AutoMount"=dword:00000001
"AutoPart"=dword:00000000
"AutoFormat"=dword:00000000
"MountFlags"=dword:00000000
"DefaultFileSystem"="FATFS"
"PartitionDriverName"="MSPART"
"Folder"="Mounted Volume"
"ActivityEvent"="PowerManager/ActivityTimer/SystemActivity"
"MountHidden"=dword:00000000
"MountAsROM"=dword:00000000
"MountPermanent"=dword:00000000
"MountAsBootable"=dword:00000000
"MountAsRoot"=dword:00000000
"MountSystem"=dword:00000000
"MountAsNetwork"=dword:00000000
"PartitionDriver"="mspart.dll"
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\FlashDrv]
"DefaultFileSystem"="BINFS"
"PartitionDriver"="mspart.dll"
"AutoMount"=dword:00000001
"AutoPart"=dword:00000001
"Folder"="ResidentFlash"
"Name"="Microsoft Flash Disk"
"BootPhase"=dword:00000000
"DisableAutoScan"=dword:00000001
"ForceWritethrough"=dword:00000001
...
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\FlashDrv\BINFS]
"MountHidden"=dword:00000000
"MountAsROM"=dword:00000001
"MountPermanent"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\FlashDrv\FATFS]
"AutoFormat"=dword:00000001
"FatCacheSize"=dword:00000000
"DataCacheSize"=dword:00000000
"BitmapCacheSize"=dword:00000000
"DisableAutoScan"=dword:00000001
"DisableAutoFormat"=dword:00000000
"ForceWritethrough"=dword:00000001
"EnableWriteBack"=dword:00000000
"NonatomicSector"=dword:00000001
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\FlashDrv\PART_R3]
"FriendlyName"="FAT FileSystem"
"Dll"="exfat.dll"
"Paging"=dword:00000001
"FatCacheSize"=dword:00000000
"DataCacheSize"=dword:00000000
"Util"="fatutil.dll"
"DisableAutoScan"=dword:00000001
"ForceWritethrough"=dword:00000001
"PartitionDriver"="mspart.dll"
"AutoMount"=dword:00000001
"Folder"="NandFlash"
"EnableWriteBack"=dword:00000000
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\HDProfile]
"MountAsBootable"=dword:00000001
...
Any help will highly appriciate!

Anyone?
Is there is in XDA some proper PNA forum?
Couldn't find one...

[Q] FSP loox 720 custom ROM. Is it real?

hello.
revived, I still own a pda FS Loox 720
is it possible to make custom rom for this PDA? made of nbf nb0, but he did not see any one program to extract/edit/remove files from the directory works correctly only Dumpromx, but it only allows you to extract the firmware and replace the files, not more.

a short walk to dump the firmware ...
shows that the
start_rom ecec and not one in the firmware of wm2003se.
obtained 13 pieces:
Code:
0. start 80040000
0. ecec 8009edb8
1. start 80180000
1. ecec 802e5c00
2. start 80404000
2. ecec 8097fc98
3. start 809b0000
3. ecec 80a494cc
4. start 80b20000
4. ecec 80c2132c
5. start 80cf0000
5. ecec 80e68394
6. start 80ff0000
6. ecec 81446630
7. start 81470000
7. ecec 814a2ae0
8. start 818b0000
8. ecec 818d5360
9. start 81a20000
9. ecec 81ce8350
10. start 81df0000
10. ecec 81e636d0
11. start 81e80000
11. ecec 81f2ffac
12. start 81f50000
12. ecec 81fa5c3c
13. start 82000000
13. ecec 821cc02c
an example of the firmware:
Code:
80040000 - 80040000 L00000000 rom_00 start
80040000 - 80040004 L00000004 JUMP to kernel start
80040004 - 80040040 L0000003c NUL
80040040 - 80040048 L00000008 'ECEC' -> 8009edb8
80040048 - 80041000 L00000fb8 NUL
80041000 - 8009e7f0 L0005d7f0 o32 region_0 rva=00001000 vsize=0005d7f0 real=80041000 psize=0005d800 f=60000020 for nk.exe
...
80176390 - 80176390 L00000000 rom_00 end
...
81f30808 - 81f30824 L0000001c filent 62 00000805 01c420356cf64524 7498 2039 81f2f7b4 VehicleML.pxt
81f30824 - 81f30824 L00000000 rom_11 end
81f30824 - 81f50000 L0001f7dc NUL
81f50000 - 81f50000 L00000000 rom_12 start
81f50000 - 81f50022 L00000022 filedata h_termservclient.lnk
81f50024 - 81f50034 L00000010 filedata mstsc.lnk
81f50034 - 81f5003d L00000009 modname l2tp.dll
81f50040 - 81f50048 L00000008 'ECEC' -> 81fa5c3c
81f50048 - 81f50fa5 L00000f5d o32 region_2 rva=0004b000 vsize=00001e20 real=0390b000 psize=00000f5d f=40002040 for ipsecsvc.dll
...
81fdaf38 - 81fdaf38 L00000000 rom_12 end
81fdaf38 - 82000000 L000250c8 NUL
82000000 - 82000000 L00000000 rom_13 start
82000000 - 82000018 L00000018 filedata Camera.lnk
82000018 - 8200003b L00000023 filedata CameraWizard.lnk
8200003b - 82000040 L00000005 NUL
82000040 - 82000048 L00000008 'ECEC' -> 821cc02c
....
821cc5c0 - 821cc5dc L0000001c filent 48 00000807 01c4c54239f7e7b7 25600 12138 821c8d8c OV9640.dll
821cc5dc - 821cc5dc L00000000 rom_13 end
821cc5dc - 82200000 unknown
on this and can give an error all the programs?
as they say in the instructions that only one should be romhdr Pointer, and then as many as 14.
and can therefore be extracted only that it was between the first and start rom_00 romhdr pointer. and the rest of the start rom_01 - start rom_13 prog and are not intended as unaware of their existence.
3. Insert this value (4 bytes!) in little endian at offset 0x48 in the NB0 (overwriting original info there). If the original info was part of some file or module in the image, hence corrupting it, you will be able to get that file from unmodified NB0 using dumprom or dumpromx (see below), then use xipport to reinsert the file before rebuilding the image so no worries.
Example for the nec 900c: start adress: 0x84080000, romhdr pointer: 0x85e9c945, 4 bytes to insert: 45 C9 E1 01 (0x84080000 subtracted from 0x85e9c945 and converted to little endian).
That’s all for preparing the NB0 image!
Click to expand...
Click to collapse
say, individually unpack it all, changing the value 0x48 + 4 bytes by calculations for each rom start_ **
and how to combine into one and then the whole firmware? because there will be 14 directories OUT ...
or if / delete / add anything in just one, for example, rom start_05 other rom start_0 * will not be affected?

obtained as follows:
ECEC [4 bytes romhdr pointer] [4 byte subtraction rom start of romhdr pointer] (it's all in the recursively)
but the prog is only the first and all. then not a word ....
first attempt to remove the ECEC and the following bytes to anything nor has led ...
helped to partition a file into 14 parts.
I'm 14 and got modulyaimi directories and files.
but back pack does not work, because it requires coredll. *, and it only be in rom start_00
may suggest how to pack back the modified modules without module coredll

so.
thanks to several people who appeared program that allows you to now edit the firmware for Win CE 4.2.
ask for help in editing, but rather create a custom firmware for a PDA.
list of files attached.
well defined with neskokolkimi programs that do not really need and / or rarely used.
list of files
Code:
oeminfo.xml
defaultconfig.xml
wm_start.wma
Voicbeep.wav
type.wav
Splat.wav
RecEnd.wav
Quietest.wav
online.wav
notify.wav
msgbox.wav
MenuPop.wav
Lowbatt.wav
Loudest.wav
Infend.wav
Infbeg.wav
hwandsw.wav
Default.wav
Alarm4.wav
Alarm3.wav
Alarm2.wav
Alarm1.wav
mxip_XIPKERNEL.ver
mxip_SHELL.ver
mxip_PICTURES192.ver
mxip_OS.ver
mxip_MISC.ver
mxip_LANGSHELL.ver
mxip_LANGCOREAPPS.ver
mxip_KERNEL.ver
mxip_EXAPPS.ver
mxip_CPUOPT.ver
mxip_COREAPPS.ver
mxip_BROWSING.ver
tscscan.txt
sym.txt
hwhelp.txt
autocorrect.txt
AKU_OU1.txt
tahomabd.ttf
tahoma.ttf
cour.ttf
Bliss.tsk
square192.skn
square96.skn
portrait192.skn
portrait96.skn
landscape192.skn
landscape96.skn
nk-exe.sig
coredll-dll.sig
mxip_xipkernel_100.rgu
mxip_shell_100.rgu
mxip_PICTURES192_100.rgu
mxip_OS_100.rgu
mxip_misc_100.rgu
mxip_LANGSHELL_100.rgu
mxip_LANGCOREAPPS_100.rgu
mxip_KERNEL_100.rgu
mxip_EXAPPS_100.rgu
mxip_CPUOPT_100.rgu
mxip_COREAPPS_100.rgu
mxip_BROWSING_100.rgu
CW-registry.reg
VehicleML.pxt
todo.pwi
phone.pwi
memo.pwi
meeting.pwi
blank.pwi
todo.psw
phone.psw
memo.psw
meeting.psw
blank.psw
sysroots.p7b
wince.nls
Region_1_0.nlp
Culture3_1_0.nlp
Culture2_1_0.nlp
Culture1_1_0.nlp
CharInfo_1_0.nlp
Calendar_1_0.nlp
wsp.dll.0409.mui
wininet.dll.0409.mui
waveapi.dll.0409.mui
urlmon.dll.0409.mui
unimodem.dll.0409.mui
shlwapi.dll.0409.mui
netmui.dll.0409.mui
mlang.dll.0409.mui
malcommon.dll.0409.mui
jawres.dll.0409.mui
IECEExt.dll.0409.mui
fatutil.dll.0409.mui
coredll.dll.0409.mui
commdlg.dll.0409.mui
wm_start.lnk
WLNPWRCTL.lnk
WindowsMedia.lnk
welcome.lnk
voice.lnk
Transcriber.lnk
Tone.lnk
tmail.lnk
tasks.lnk
sync.lnk
square.lnk
solitare.lnk
RunningPrograms.lnk
romupdnote.lnk
repllog.lnk
pxl.lnk
pword.lnk
Processor.lnk
poutlook.lnk
portrait.lnk
pmail.lnk
pimg.lnk
pie.lnk
notetake.lnk
mstsc.lnk
MSNMsgr.lnk
MSNMobile.lnk
LEAP.lnk
landscape.lnk
KeyLock1.lnk
Jawbreaker.lnk
hotvoice.lnk
help.lnk
h_wmppc.lnk
h_wince.lnk
h_termservclient.lnk
h_tasks.lnk
h_sync.lnk
h_soltr.lnk
h_simrdr.lnk
h_pxl.lnk
h_pword.lnk
h_pimg.lnk
h_pie.lnk
h_Jawbreaker.lnk
h_inkwrit.lnk
h_inbox.lnk
h_im.lnk
h_ctpnl.lnk
h_connct.lnk
h_cntcs.lnk
h_clndr.lnk
h_calc.lnk
h_bluetooth.lnk
gamesico.lnk
FSCSpeedMenu3.lnk
FSCSpeedMenu2.lnk
FSCPanning.lnk
FSCEasy2Connect_hlp.lnk
FSCEasy2Connect_exe.lnk
FSCBackup_hlp.lnk
FSCBackup_exe.lnk
FSCautorun_hlp.lnk
FSC_Panning.lnk
find.lnk
fexplore.lnk
eventrst.lnk
Enroll.lnk
DispLighting1.lnk
Connections.lnk
CameraWizard.lnk
Camera.lnk
calendar.lnk
calc.lnk
BTTrayCE.lnk
Bluetooth.lnk
Battery1.lnk
async.lnk
AlignScreen.lnk
Album.lnk
addrbook.lnk
mssp2_en.lex
OEM.jpg
DOL.jpg
AudioBK.jpg
initdb.ini
FSCSMdef.ini
wmppc.htm
wince.htm
TranscriberEnu.htm
termservclient.htm
tasks.htm
sync.htm
soltr.htm
SIMReader.htm
rnetw.htm
pword.htm
pocketmsn.htm
piehelp.htm
pic.htm
pexcel.htm
notes.htm
KeyLock.htm
Jawbreaker.htm
inbox.htm
im.htm
FSCSpeedMenu.htm
FSCEasy2Connect20.htm
FSCautorun.htm
FSC_Panning.htm
FSC_Backup.htm
evbruntime.htm
Enroll.htm
default.htm
ctpnl.htm
connect.htm
cntcs.htm
clndr.htm
CameraWizard_(ht)b.htm
CameraWizard_(ht).htm
calc.htm
btwcehlp.htm
bluetooth.htm
agdefault.htm
16_oem.htm
TIPostInit.hcs
TICoexEnable.hcs
TICoexDisable.hcs
BTVoiceEnable.hcs
BTVoiceDisable.hcs
welcomehead.192.gif
volumethumbSQ192.gif
volumethumbSQ96.gif
volumethumb192.gif
volumethumb96.gif
VideoBK.gif
Totem-Heart.gif
Totem.gif
t_msgr.gif
SyncAnimation.gif
stylushead.192.gif
stylus2.192.gif
stylus1.192.gif
stylus1.96.gif
square192.gif
square96.gif
seekthumbSQ192.gif
seekthumbSQ96.gif
seekthumb192.gif
seekthumb96.gif
pushedSQ192.gif
pushedSQ96.gif
pushed192.gif
pushed96.gif
ppc.gif
portrait192.gif
portrait96.gif
piecarrier.gif
oem.gif
myinfo.gif
msn.gif
Magazine.gif
landscape192.gif
landscape96.gif
IMWater.gif
IMAddSuccess.gif
IMAddFailure.gif
FSCSpeedMenu.gif
fly.gif
disabledSQ192.gif
disabledSQ96.gif
disabled192.gif
disabled96.gif
Default_stwater_480_480.gif
Default_stwater.gif
dayview.192.gif
dayview.96.gif
complete.192.gif
Clothes-Line.gif
beam.gif
bannerstrip.gif
banner.gif
avantgo.gif
arrow2.192.gif
11select.192.gif
11select.96.gif
Gprs.gdb
default.fdf
www-Hotspot.fbk
www-GPRS.fbk
wmplayer.exe
WLNPWRCTL.exe
welcome.exe
wceloadsp.exe
wceload.exe
updatexip.exe
unload.exe
umarshaller.exe
udp2tcp.exe
TraShapeSelector.Exe
Transcriber.Exe
Tone.exe
tmarshaller.exe
tmail.exe
testReg.exe
tasks.exe
srvtrust.exe
solitare.exe
sndplay.exe
shfind.exe
shell32.exe
services.exe
rundll32.exe
romupdnote.exe
rnaapp.exe
repllog.exe
remnet.exe
rapisrv.exe
pxl.exe
pword.exe
Processor.exe
PowerWLAN.exe
PowerExe.exe
poutlook.exe
pimg.exe
peghelp.exe
notes.exe
nk.exe
mstsc40.exe
mstli.exe
LEAP.exe
KeyLockRes.exe
jawbreaker.exe
instmsgr.exe
iexplore.exe
idledetect.exe
hwhelp.exe
hotvoice.exe
HFPUI.exe
gwes.exe
FSCSpeedMenu.exe
FSCEasy2Connect20.exe
FSC_PwdStart.exe
FSC_PwdCheck.exe
FSC_Panning.exe
FSC_Backup.exe
filesys.exe
fexplore.exe
eventrst.exe
Enroll.exe
device.exe
ctlpnl.exe
cow.exe
connmgr.exe
coldinit.exe
clocknot.exe
clock.exe
cgacutil.exe
cfdetect.exe
certinst.exe
Camera.exe
calnot.exe
calendar.exe
calc.exe
BTWizardCE.exe
BTTrayCE.exe
BTPanManagerCE.exe
BTFileExplorer.exe
BTCplCE.exe
BTConnManagerCE.exe
BTCePimCmdApp.exe
BTBusinessCard.exe
beam.exe
Backlight.exe
Album.exe
adjustmem.exe
addrbook.exe
XSCSDCard.dll
xls2pxl.dll
wzcsvc.dll
wzcsapi.dll
wsppush.dll
wspm.dll
wsp.dll
ws2instl.dll
ws2.dll
wmvdecoder.dll
wmres.dll
wmlview.dll
wmcore.dll
wmavdecoder.dll
wmadecoder.dll
wldap32.dll
winsock.dll
wininet.dll
wendyser.dll
webview.dll
wdppush.dll
wcestreambt.dll
WBtDll.dll
wbtapiCE.dll
wavedev.dll
waveapi.dll
wapdrv.dll
wap.dll
voicedll.dll
VoiceCtl.dll
VoiceBar.dll
VCOMCtl.dll
VBarCall.dll
usbmsc.dll
usbhid.dll
usbdisk6.dll
usbd.dll
urlmon.dll
unimodem.dll
uicom.dll
tshres.192.dll
tshres.dll
tsctrc.dll
trustmarshaller.dll
TraRes0409.192.dll
TraRes0409.dll
TraRecoEnu.dll
TranscriberSip.Dll
touch.dll
toolhelp.dll
tmailutl.dll
TIRadioInit.dll
tiacxwln.dll
termctrl.dll
tcpstk.dll
tcpip6.dll
taskdll.dll
tapres.192.dll
tapi.dll
syscsps.dll
syncres.192.dll
syncres.dll
syncmgr.dll
stcusb.dll
ssllsp.dll
spnego.dll
softkb.dll
shutil.dll
shlwapi.dll
shellresapps.192.dll
shellresapps.96.dll
shellresapps.dll
shellres.192.dll
shellres.dll
servhost.dll
serial32.dll
serial.dll
secur32.dll
SecIDLib.dll
SDMemory.dll
SdkCE.dll
SDBusDriver.dll
schannel.dll
rsaenh.dll
rra_stm.dll
riresdll.192.dll
riresdll.96.dll
riresdll.dll
richink.dll
relfsd.dll
regenum.dll
redir.dll
rdpdr.dll
rdpapi.dll
pxlfile.dll
pxl2xls.dll
pwwiff.dll
pwddll.dll
pushrouter.dll
pushprxy.dll
psmfsd.dll
pptp.dll
ppp.dll
pm.dll
pimutil.dll
pimstore.dll
pimdlg.dll
pimapi.dll
pegobj.dll
pegcards.192.dll
pegcards.dll
pcmcia.dll
OV9640.dll
outres.192.dll
outres.dll
ossvcs.dll
olece300.dll
oleaut32.dll
ole32.dll
ohci.dll
officeres.192.dll
officeres.dll
office.dll
OEMUtil.dll
oemregistry.dll
oectrl.dll
obexsrvr.dll
obexinbx.dll
obexapi.dll
ntlmssp.dll
nspm.dll
note_prj.dll
note.dll
netui.dll
netmui.dll
netcfagl1_0.dll
netbios.dll
ne2000.dll
ndisuio.dll
ndis.dll
msxml.dll
msscript.dll
mspart.dll
msnsspc.dll
msnewmnu.dll
msmsgsc.dll
msimnetc.dll
msimmsgr.dll
msim.192.dll
msim.dll
MsgStore.dll
msgslang.dll
msdmo.dll
mscoree1_0.dll
mscoree.dll
msasn1.dll
MPEG4SPVIDEOENC.dll
MP4Writer.DLL
mp4spvd.dll
MP4_READER.dll
mmtimer.dll
mlang.dll
miscres.192.dll
miscres.dll
MidiLib2.dll
mfcce300.dll
malcommon.dll
malclmgr.dll
mailtrns.dll
l2tp.dll
KeyLock.dll
keybddr.dll
kbdhid.dll
jscript.dll
JPEGENC.dll
jpeg.dll
jawres.dll
Jacket.dll
irsqrt.dll
irsir.dll
irdastk.dll
ircomm.dll
ipv6hlp.dll
ipsecsvc.dll
ipsec.dll
iphlpapi.dll
inreplce.dll
inkx.dll
inkobj.dll
infantry.dll
imgdecmp.dll
IMEngine.dll
imaging.dll
imagelib.dll
IECEExt.dll
htmlview.dll
HTCcamera1.dll
hidparse.dll
HFPControlPanel.dll
H263VIDEOENC.DLL
gxdma.dll
gx.dll
GSMAMRENC.dll
GSMAMRDLL.dll
GAC_System_v1_0_5000_0_cneutral_1.dll
GAC_System.Xml_v1_0_5000_0_cneutral_1.dll
GAC_System.Windows.Forms_v1_0_5000_0_cneutral_1.dll
GAC_System.Windows.Forms.DataGrid_v1_0_5000_0_cneutral_1.dll
GAC_System.Web.Services_v1_0_5000_0_cneutral_1.dll
GAC_System.Net.IrDA_v1_0_5000_0_cneutral_1.dll
GAC_System.Drawing_v1_0_5000_0_cneutral_1.dll
GAC_System.Data_v1_0_5000_0_cneutral_1.dll
GAC_mscorlib_v1_0_5000_0_cneutral_1.dll
GAC_Microsoft.WindowsCE.Forms_v1_0_5000_0_cneutral_1.dll
GAC_Microsoft.VisualBasic_v7_0_5000_0_cneutral_1.dll
fsdmgr.dll
FSCSMrsc.dll
FSCE2CRes.dll
FSC_LXInfo.dll
Frontlight.dll
find.dll
fatutil.dll
fatfsd.dll
exappres.192.dll
exappres.dll
ethman.dll
eaptls.dll
eapol.dll
eapchap.dll
eap.dll
dssdh.dll
doclist.dll
dhcp.dll
ddi.dll
cxport.dll
cspras.dll
cspproxy.dll
cspnet.dll
crypt32.dll
coreres.192.dll
coreres.dll
coredll.dll
connplan.dll
conncfg.dll
configmanager.dll
compime.dll
commdlg.dll
commctrl.dll
colorConvScaling.dll
clockdll.dll
citydb.dll
chngtrk.dll
cespell.dll
ceshell.dll
cemapi.dll
cemailsync.dll
cellcore.dll
cefobj.dll
cedrmutil.dll
ceddk.dll
ccoreprv.dll
calstore.dll
caldll.dll
cabinstl.dll
bvd_udc_ser.dll
BTWizardProfiles.dll
BTWizardHfp.dll
BtSdkCE30.dll
btrez.dll
bthutil.dll
bthusb.dll
bthuniv.dll
bthuart.dll
bthsc.dll
bthlink.dll
bthcsr.dll
bthamb.dll
btdrt.dll
BTDialer.dll
btd.dll
BtCoreIf.dll
BTChooserLib.dll
BtCeStack.dll
BtCeSendTo_Poom.dll
BtCeProfiles.dll
btcepan.dll
BTCeOsif4.dll
BtCeIf.dll
BtCeBCSPTrans.dll
BTAudioGW.dll
browsres.192.dll
browsres.dll
browser.dll
battdrvr.dll
aygshell.dll
audevman.dll
atlce300.dll
atadisk.dll
asyncmac.dll
asfplayer.dll
appinstaller.dll
Album_Res.dll
airsync.dll
agiehandler.dll
afd.dll
adosync.dll
adoceoledb30.dll
adocedb30.dll
adoce30.dll
addrstor.dll
addrdll.dll
abstraction.dll
AACDLL.dll
statdict.dat
splash.dat
pwipat.dat
initobj.dat
dictprob.dat
SystemInfo.cpl
PowerWLAN.cpl
Powerg.cpl
cplmain.cpl
BTConfigCE.cpl
Backlight.cpl
malconfig.cfg
Zoom-Indicator.bmp
zoom.bmp
winmedia.bmp
webguide.bmp
volume.bmp
voicetag.bmp
Thumbnail-view.bmp
sysvol.bmp
slideshow.bmp
sending.192.bmp
sending.96.bmp
senddsbl.192.bmp
senddsbl.96.bmp
send.192.bmp
send.96.bmp
rotate.bmp
Remaining-video-time.bmp
Remaining-images.bmp
question.bmp
ppccom.bmp
Picture-Theme-Next-Previous-arrows.bmp
Msrg_undo.bmp
Msrg_tab.bmp
Msrg_space.bmp
Msrg_paste.bmp
Msrg_entr.bmp
Msrg_cut.bmp
Msrg_copy.bmp
Msrg_case.bmp
Msrg_back.bmp
Msrg_all.bmp
msn_mail.bmp
msn.bmp
Full-Screen-exit-icon.bmp
Full-Screen-entrance-icon.bmp
device.bmp
crop.bmp
Confirm-Send.bmp
Confirm-Detailed-View.bmp
Confirm-Delete.bmp
Confirm-Back.bmp
Capture-Size.bmp
Capture-Indicator.bmp
Camera-Settings.bmp
bt_tran.bmp
bt_spc.bmp
bt_rtn.bmp
bt_rmode.bmp
bt_rarr.bmp
bt_optns.bmp
bt_lss.bmp
bt_larr.bmp
bt_kbrd.bmp
bt_help.bmp
bt_bspc.bmp
appointment.bmp
Ambience-Incandescent.bmp
Ambience-Fluorescent.bmp
Ambience-Daylight.bmp
alerts.bmp
aglogo.bmp
maxim_radio_dl.bin
ACX100_dl.bin
async.asy
gsm610.acm
wmlb.2bp
wm_wmcom.2bp
wm_volume.2bp
wm_unmute.2bp
wm_stop.2bp
wm_progress.2bp
wm_previous.2bp
wm_play.2bp
wm_pause.2bp
wm_next.2bp
wm_info.2bp
wm_fullscreen.2bp
Win_Start.2bp
web_content.2bp
vcard.2bp
up_play.2bp
undo.2bp
toolbar.2bp
Tip_Icon.2bp
Stop_icon.2bp
stop.2bp
space.2bp
Signal_Strength_Yellow.2bp
Signal_Strength_RED.2bp
Signal_Strength_Green.2bp
send.2bp
scard.2bp
reply.2bp
Refresh_icon.2bp
Red_Bul.2bp
record.2bp
play_play.2bp
pen.2bp
NewCard.2bp
mic.2bp
line.2bp
light.2bp
input.2bp
info_play.2bp
Icon_Work.2bp
Icon_Ntwk_Card.2bp
Icon_Init.2bp
Icon_Connect_Internet.2bp
Icon_Connect.2bp
format.2bp
Folder_icon.2bp
flag.2bp
favorite.2bp
Edit_profile_icon.2bp
Edit_Num.2bp
drform.2bp
down_play.2bp
direct16.2bp
dialup16.2bp
Dial_Num.2bp
deletefolder.2bp
delete_play.2bp
dataconnection.2bp
chooser_prev.2bp
chooser_next.2bp
cf.2bp
BT_PhoneDialer.2bp
BT_icon_Gray.2bp
BT_icon_Blue.2bp
BT_Globe_icon.2bp
BT_BizCard_icon.2bp
brcm_ppc.2bp
Blu_Bul.2bp
autosum.2bp
attach.2bp
align.2bp
address.2bp
add_play.2bp
avantgocfg.1
avantgocfg.0
list of files found by the programs
Easy2Connect
Code:
FSCE2CRes.dll
FSCEasy2Connect_hlp.lnk
FSCEasy2Connect_exe.lnk
www-Hotspot.fbk
www-GPRS.fbk
solitare
Code:
solitare.lnk
h_soltr.lnk
gamesico.lnk
solitare.exe
soltr.htm
FSCSpeedMenu
Code:
FSCSpeedMenu.exe
FSCSpeedMenu3.lnk
FSCSpeedMenu2.lnk
FSCSMdef.ini
FSCSMrsc.dll
office
Code:
h_pxl.lnk
pxl.exe
pxl.lnk
pxl2xls.dll
pxlfile.dll
office.dll
pword.exe
h_pword.lnk
pword.lnk
xls2pxl.dll
pword.htm
pwwiff.dll
calculator
Code:
h_calc.lnk
calc.lnk
calc.htm
calc.exe
Transcriber
Code:
TraRes0409.192.dll
TraRes0409.dll
TraRecoEnu.dll
TranscriberSip.Dll
Transcriber.lnk
TranscriberENU.htm
Transcriber.exe
Msrg_undo.bmp
Msrg_tab.bmp
Msrg_space.bmp
Msrg_paste.bmp
Msrg_entr.bmp
Msrg_cut.bmp
Msrg_copy.bmp
Msrg_case.bmp
Msrg_back.bmp
Msrg_all.bmp
bt_tran.bmp
bt_spc.bmp
bt_rtn.bmp
bt_rmode.bmp
bt_rarr.bmp
bt_optns.bmp
bt_lss.bmp
bt_larr.bmp
bt_kbrd.bmp
bt_help.bmp
bt_bspc.bmp
other files:
Code:
*.psw and *.pxt
wm_start.wma
wm_start.lnk
it's all that I have found so far.
tell me what other programs, libraries, files can be deleted.
for example, wmp, outlook, tmail, etc ...

[HOW TO] WORKING screen mirroring ON ROOTED DEVICES, bypass HDCP and ALL of allshare

so here's the deal. trying to start screen mirroring on a rooted device in most cases HDCP will fail to initialize, when this happens screen mirroring will connect then disconnect with an error.
after a lot of research, logging and testing on my device I have found a way to bypass HDCP and also bypass Samsung restriction on allowing screen mirroring without HDCP.
HDCP is not a requirement for screen mirroring but Samsung has programmed the s4 to fail if the HDCP connection is not initialized. I have found that when the phone speaks to the miracast dongle the phone is programmed to force the setting of "Display service Type = HDMI" instead of allowing it to connect as Type = Wifi.
when the phone forces type = HDMI it makes screen mirroring fail if HDCP fails, this is a basic and enforced protocol of HDMI, this results in screen mirroring shutting off if HDCP fails, I believe this is Samsung's attempt to stop people from rooting their phones and also to stop people from using non Samsung dongles.
some people have found ways around this by hacking the HDCP lib files, but in my case this was not possible because I own a Sgh-i337 on mf3 with a locked bootloader.
unfortunately I can't post pictures so I can post my screen mirroring logs, but heres an explanation as to how this was accomplished.
First was to quarantine all Samsung Apps & services that were related to screen mirroring, this was an attempt to get the system to fall back to the native screen mirroring services and not use samsung's implementation.
I locked up:
Com.sec.allsharecastplayer
Com.samsung.shareshot
Samsung watch on
Samsung briefing
Allshare.controlShareService
Allshare.fileShareService
Samsung context provider
All Knox
Samsung MDM app
Allshare.service.mediaShare
Samsung apps
Samsung apps UNA2
Samsung apps widget
Samsung link
Samsung push
next I tried to find out a way to edit the DisplayManagerService's forced type of HDMI to change it to Type = Wifi, unfortunately because I was on Mf3, this couldn't be done.
but I was able to force this option with a build prop edit and last download and enable
https://play.google.com/store/apps/...+plus&pcampaignid=APPU_5MQMU6zQHOm-sQSyqoCgCA
Even if multi window plus doesnt work. Keep it for now untill I can trace down a setting change.
surprisingly after all this was done screen mirroring now works.
below I will post copies of my build prop and also the WFDConfig files from /system/ect
---- Build prop :
debug.sf.hw=0
debug.composition.7x27A.type=mdp
debug.composition.7x25A.type=mdp
dalvik.vm.heapsize=24m
debug.composition.type=dyn
persist.hwc.mdpcomp.enable=false
service.camera.gpu.enable=0
Debug.Disable.HWC=1
debug.sf.disablehwc=1
ro.display.switch=0
#dyn
# system props for the cne module
#
persist.cne.feature=0
#
# system props for the MM modules
#
media.stagefright.enable-player=true
media.stagefright.enable-meta=true
media.stagefright.enable-scan=true
media.stagefright.enable-http=false
media.stagefright.enable-fma2dp=true
media.stagefright.enable-aac=true
media.stagefright.enable-qcp=true
media.enable-commonsource=true
media.stagefright.enable-rtsp=true
#
# system props for the LPA/TUNNEL
#
lpa.decode=true
tunnel.decode=true
lpa.use-stagefright=true
tunnel.audiovideo.decode=true
#
# system prop for opengles version
#
ro.opengles.version=131072
#
# system props for the data modules
#
ro.use_data_netmgrd=true
persist.data.ds_fmc_app.mode=0
#
# system props for IMS module
#
persist.ims.regmanager.mode=0
#
# System prop to disable strict mode flash on display
#
persist.sys.strictmode.visual=false
#
# System prop to enable/disable OMH. Enabled by default
#
persist.omh.enabled=1
#System prop to enable ehrpd capability
ro.config.ehrpd=true
# System property for cabl
ro.qualcomm.cabl=0
#
#
# Turn off tiled rendering
#
debug.enabletr=false
#
#property to enable user to access Google WFD settings.
#
persist.debug.wfd.enable=1
debug.wfd.enable=1
ext_only.debug=1
persist.sys.ext_only.debug=1
persist.sys.hwc.ext_only.debug=1
persist.sys.hwc.disable=1
#property to choose between virtual/external wfd display
#
persist.sys.wfd.virtual=0
#
# System prop for Tvout/HDMI
#
persist.sys.camera.transform=0
persist.sys.camera.connect=0
persist.sys.videomode=1
ro.hdmi.enable=false
------- WFDConfig. Xml
<WFDConfig>
<Capability>
<AudioLPCM>
<Name>LPCM</Name>
<Valid>1</Valid>
<Channels>2</Channels>
<SamplingFreq>48000</SamplingFreq>
<Latency>33</Latency>
</AudioLPCM>
<AudioAAC>
<Name>AAC</Name>
<Valid>1</Valid>
<Channels>2</Channels>
<SamplingFreq>48000</SamplingFreq>
<Latency>0</Latency>
</AudioAAC>
<AudioAC3>
<Name>AC3</Name>
<Valid>0</Valid>
<Channels>0</Channels>
<SamplingFreq>0</SamplingFreq>
<Latency>0</Latency>
</AudioAC3>
<VideoHeader>
<VideoMethod>1</VideoMethod>
<PreferredDisplaySupport>0</PreferredDisplaySupport>
<H264Profiles>1</H264Profiles>
<Valid>1</Valid>
</VideoHeader>
<CBP>
<VideoCodec>
<Profile>1</Profile>
<Level>1</Level>
<HorizontalResolution>1280</HorizontalResolution>
<VerticalResolution>720</VerticalResolution>
<Latency>0</Latency>
<MinimumSliceSize>0</MinimumSliceSize>
<SliceEncodingParams>0</SliceEncodingParams>
<FrameRateControlSupp>1</FrameRateControlSupp>
<VideoFps>30</VideoFps>
</VideoCodec>
</CBP>
<StandbyResumeCapability>
<Valid>1</Valid>
</StandbyResumeCapability>
<!--
IDR interval is to trigger an IDR request from sink.
This can be applcable only to sink. IDRInterval is in msec
-->
<IDRRequest>
<Valid>0</Valid>
<IDRInterval>0</IDRInterval>
</IDRRequest>
<AVFormatChange>
<Valid>0</Valid>
<AVInterval>0</AVInterval>
</AVFormatChange>
<!--
Frame skipping interval is in the scale of 500 msec/half second.
FrameInterval can be between 1 to 7, according to the WFD spec.
-->
<FrameSkipping>
<Valid>0</Valid>
<FrameInterval>0</FrameInterval>
</FrameSkipping>
<ContentProtection>
<HDCPValid>0</HDCPValid>
<Version>WFD_HDCP_2_1</Version> <!-- Valid values WFD_HDCP_2_0 and WFD_HDCP_2_1 -->
<CPPort>6789</CPPort>
<EncryptAudio>0</EncryptAudio> <!-- Valid values 0 / 1 to indicate Audio encryption or not -->
</ContentProtection>
<RTPDumpEnable>
<Valid>0</Valid>
</RTPDumpEnable>
<BufferCtrlEnable>
<Valid>1</Valid>
</BufferCtrlEnable>
<UIBC>
<UIBCValid>1</UIBCValid> <!-- 0/1 UIBC supported or not -->
<InputCategory>
<Generic>1</Generic> <!-- 0/1 - support generic or not -->
</InputCategory>
<InputEvents>
<GenericInputEvents>
<Mouse>1</Mouse> <!-- 0/1 for all Input Event Types -->
<Keyboard>1</Keyboard>
<SingleTouch>1</SingleTouch>
<MultiTouch>1</MultiTouch>
<JoyStick>0</JoyStick>
<Camera>0</Camera>
<Gesture>0</Gesture>
<RemoteControl>1</RemoteControl>
</GenericInputEvents>
</InputEvents>
<TcpPort>4321</TcpPort>
</UIBC>
</Capability>
---- Capability. Xml
<Capability>
<AudioLPCM>
<Name>LPCM</Name>
<Valid>1</Valid>
<Channels>2</Channels>
<SamplingFreq>48000</SamplingFreq>
<Latency>33</Latency>
</AudioLPCM>
<AudioAAC>
<Name>AAC</Name>
<Valid>1</Valid>
<Channels>2</Channels>
<SamplingFreq>48000</SamplingFreq>
<Latency>0</Latency>
</AudioAAC>
<AudioAC3>
<Name>AC3</Name>
<Valid>0</Valid>
<Channels>0</Channels>
<SamplingFreq>0</SamplingFreq>
<Latency>0</Latency>
</AudioAC3>
<VideoHeader>
<VideoMethod>1</VideoMethod>
<PreferredDisplaySupport>0</PreferredDisplaySupport>
<H264Profiles>1</H264Profiles>
<Valid>1</Valid>
</VideoHeader>
<CBP>
<VideoCodec>
<Profile>1</Profile>
<Level>1</Level>
<HorizontalResolution>1280</HorizontalResolution>
<VerticalResolution>720</VerticalResolution>
<Latency>0</Latency>
<MinimumSliceSize>0</MinimumSliceSize>
<SliceEncodingParams>0</SliceEncodingParams>
<FrameRateControlSupp>1</FrameRateControlSupp>
<VideoFps>30</VideoFps>
</VideoCodec>
</CBP>
<CHP>
<VideoCodec>
<Profile>2</Profile>
<Level>1</Level>
<HorizontalResolution>800</HorizontalResolution>
<VerticalResolution>480</VerticalResolution>
<Latency>0</Latency>
<MinimumSliceSize>0</MinimumSliceSize>
<SliceEncodingParams>0</SliceEncodingParams>
<FrameRateControlSupp>1</FrameRateControlSupp>
<VideoFps>30</VideoFps>
</VideoCodec>
</CHP>
<StandbyResumeCapability>
<Valid>1</Valid>
</StandbyResumeCapability>
<!--
IDR interval is to trigger an IDR request from sink.
This can be applcable only to sink. IDRInterval is in msec
-->
<IDRRequest>
<Valid>0</Valid>
<IDRInterval>0</IDRInterval>
</IDRRequest>
<AVFormatChange>
<Valid>0</Valid>
<AVInterval>0</AVInterval>
</AVFormatChange>
<!--
Frame skipping interval is in the scale of 500 msec/half second.
FrameInterval can be between 1 to 7, according to the WFD spec.
-->
<FrameSkipping>
<Valid>0</Valid>
<FrameInterval>0</FrameInterval>
</FrameSkipping>
<ContentProtection>
<HDCPValid>0</HDCPValid>
<Version>WFD_HDCP_2_1</Version> <!-- Valid values WFD_HDCP_2_0 and WFD_HDCP_2_1 -->
<CPPort>6789</CPPort>
</ContentProtection>
<RTPPortType>
<ConnectionType>0</ConnectionType> <!-- 0 - UDP ,1 - TCP -->
</RTPPortType>
<RTPDumpEnable>
<Valid>0</Valid> <!-- Enable RTP Dump Valid = 1 or Valid = 0-->
</RTPDumpEnable>
<UIBC>
<UIBCValid>0</UIBCValid> <!-- 0/1 UIBC supported or not -->
<InputCategory>
<Generic>1</Generic> <!-- 0/1 - support generic or not -->
</InputCategory>
<InputEvents>
<GenericInputEvents>
<Mouse>1</Mouse> <!-- 0/1 for all Input Event Types -->
<Keyboard>1</Keyboard>
<SingleTouch>1</SingleTouch>
<MultiTouch>1</MultiTouch>
<JoyStick>1</JoyStick>
<Camera>0</Camera>
<Gesture>0</Gesture>
<RemoteControl>1</RemoteControl>
</GenericInputEvents>
</InputEvents>
<TcpPort>4321</TcpPort>
</UIBC>
</Capability>
I claim no responsibility for you changing files on your own phone, this fixed took me about a month of constant work and if you change the wrong files it may brick your phone.
I have had a 90% success rate with connecting when I connect Right after restarting the phone.
Restart, and as soon as your lock screen comes up. Unlock your phone and connect to your dongle. Then you will have clean connects.
If ive helped you fix screen mirroring
And you would like to thank me.... buy me a coffee
PayPal: [email protected]

Working for i747 S3
I was about to try the library edit technique for my S3 (i747) when I stumbled upon your post. I modified one line in the wfdconfig.xml after I compared my file to yours. I updated it through the file manager in TWRP recovery, rebooted and it worked!
Code:
<HDCPValid>0</HDCPValid>
Thanks!

sternem said:
I was about to try the library edit technique for my S3 (i747) when I stumbled upon your post. I modified one line in the wfdconfig.xml after I compared my file to yours. I updated it through the file manager in TWRP recovery, rebooted and it worked!
Code:
<HDCPValid>0</HDCPValid>
Thanks!
Click to expand...
Click to collapse
I have a Sprint Samsung Galaxy S4 (SPH-L720) and made the one change to HDCPValid, and my screen mirroring started working again. Thank you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Cannot find wfdconfig.xml on my i9500
hahansen3 said:
I have a Sprint Samsung Galaxy S4 (SPH-L720) and made the one change to HDCPValid, and my screen mirroring started working again. Thank you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Click to expand...
Click to collapse
I searched a lot and am not able to find wfdconfig.xml on my i9500 s4 rooted with cfautoroot on official 4.4.2
Does anyone know if the above works for kitkat or are the filesddifferent for kitkat?
Thanks in advance!

Device not HDCP compilant
Hi Guys,
Any setting I can make to the xml file that will allow me to use my TV which as it seems is not HDCP compliant? I am using the measy a2w and for mirror I get as far as connecting then it goes downhill.... unable to enable mirroring device connected is not HDCP supported. I have a HDCP compliant monitor that I can hook up but wanted to use the TV.....

Patch for SHV-E210S (Galaxy S3, SGS3)
Hi,
I keep receiving PMs saying "how did you do it?" about the patch.
First of all, I am not the developer who made this patch. I am just copying modifications made by him.
Here is a short description of steps to follow if you want to do the same for other devices:
1. download and install IDA Pro
2. download and install WinHEx
3. download and install any text compare util
4. Open patched and unpatched version lib file of the same device (any device) with IDA
5. get text output of both files to the text compare utility
6. find the 3 differences. analyze where they are in the file (look for seacrhable text patterns)
7. open YOUR device's unpacthed lib file with IDA pro
8. find the correspondances found on step 6 in your own file.
9. note the line number (hex address) of each 3 correspondances
10. now open all 3 files on Winhex
11. jump to the noted hex addresses and change the bytes according to the difference of 2 files of the same device.
12. make the change on your own file and save.
I hope it helps some of you..
Click to expand...
Click to collapse
Here's my modified libWFD_ENGINE.so for Samsung Galaxy S3 (SHV-E210S).
I got it working on E210SKSUGNA2.. I recommend not to try on other version cause it may brick your system ( I did :crying: )
and here are some differencies for you, in case you need some modifying job..

exxocism said:
Here's my modified libWFD_ENGINE.so for Samsung Galaxy S3 (SHV-E210S).
I got it working on E210SKSUGNA2.. I recommend not to try on other version cause it may brick your system ( I did :crying: )
and here are some differencies for you, in case you need some modifying job..
Click to expand...
Click to collapse
There's NO libWFD_ENGINE.so in system/lib. Any idea ?
S4 i9500 OzcanROM

Unable to use Screen Mirrioring On rooted S3 SHWM440S SKT
iAndroidTH said:
There's NO libWFD_ENGINE.so in system/lib. Any idea ?
S4 i9500 OzcanROM
Click to expand...
Click to collapse
Hi i have read though your post but am unable to understand how to activate Screen Mirroring on rooted S3 SHWM440S 3G SKT. The screen mirroring feature used to work just fine when my device was not rooted but after rooting this feature on activation shows a message as some hardware issue.
I would request to develop some app or a simpler process by which i can activate screen mirroring on my device once again.
Please reply on this and resolve this problem.
I am not an Android developer so would request for help here from several android enthusiasts who would try to develop an app which can modify HDCP and start screen mirroring once again.
I suppose the app would be in high demand even if a price has to be paid for it.
Awaiting reply.

Just as an FYI for some people, if you don't see <HDCPValid>1</HDCPValid> in /system/etc/wfdconfig.xml (which would get changed to 0), it may show as <Valid>1</Valid> instead. That's the way mine showed up. Search through your xml file until you see this:
<ContentProtection>
<HDCPValid>0</HDCPValid>
<Version>WFD_HDCP_2_1</Version> <!-- Valid values WFD_HDCP_2_0 and WFD_HDCP_2_1 -->
<CPPort>6789</CPPort>
<EncryptAudio>0</EncryptAudio> <!-- Valid values 0 / 1 to indicate Audio encryption or not -->
</ContentProtection>
Mine showed up as:
<ContentProtection>
<Valid>0</Valid>
<Version>WFD_HDCP_2_1</Version> <!-- Valid values WFD_HDCP_2_0 and WFD_HDCP_2_1 -->
<CPPort>6789</CPPort>
<EncryptAudio>0</EncryptAudio> <!-- Valid values 0 / 1 to indicate Audio encryption or not -->
</ContentProtection>
I'll try it tonight, and if it still doesn't work, I'll change Valid to HDCPValid and see if that makes a difference.

I'm trying to get this to work on an AT&T Note 2 running 4.4.2 AGNI kernel, but I don't have the "WFDConfig" file in system/etc. I tried this build.prop edit "wlan.wfd.hdcp=disable" and it got rid of the "hardware" error. Now it keeps saying "An update has been downloaded. Restart screen mirroring to connect" , over and over again. I have frozen most of the processes that are listed in the op with Titanium Backup, as I didn't see a few of them. Any suggestions?

Screw this, recently rooted my phone just to see that mirrorscreen doesnt work AT ALL. Why release a custom rom if some of the features are broken? I'm going back to stock.

freakyfranks said:
I'm trying to get this to work on an AT&T Note 2 running 4.4.2 AGNI kernel, but I don't have the "WFDConfig" file in system/etc. I tried this build.prop edit "wlan.wfd.hdcp=disable" and it got rid of the "hardware" error. Now it keeps saying "An update has been downloaded. Restart screen mirroring to connect" , over and over again. I have frozen most of the processes that are listed in the op with Titanium Backup, as I didn't see a few of them. Any suggestions?
Click to expand...
Click to collapse
This actually worked for me on the Note 4 Exynos variant.
Just added the wlan.wfd.hdcp=disabled to my build.prop restarted the phone and screen mirroring now works no need to decompile a pesky .so file anymore

Three things to do to restore dhcp
install x-plorer from playstore en do what i do on this video ps phone has to be rooted. A small donate would be nice for months of work.
watch my video on youtube ussername chousein84

Can anyone maked this work on a xperia?
Sent from my D6503 using XDA Free mobile app

Lost.soul said:
This actually worked for me on the Note 4 Exynos variant.
Just added the wlan.wfd.hdcp=disabled to my build.prop restarted the phone and screen mirroring now works no need to decompile a pesky .so file anymore
Click to expand...
Click to collapse
Doesn't work for me on my S3 i9300 rooted.
I am able to connect to my tv but the screen on my tv is black and i don't see my smartphone.
If i use screen mirroring directly on my photo or video it works.
Any suggestion?
Thanks in advanced and sorry for my english...

I managed to get it working on a Sony Xperia Z3 Compact (rooted android 5.1) by changing
<ContentProtection>
<Valid>1</Valid>
to
<ContentProtection>
<Valid>0</Valid>
Works on a fireTV Stick (first generation)

on my galaxy tab 3 8.0 i finally manage to have root and screen mirroring by 1)flashing with odin the stock 4.4.2 rom
2)root from pc
3)replace the libWFDengine.so that i found from a thread

kos25k said:
on my galaxy tab 3 8.0 i finally manage to have root and screen mirroring by 1)flashing with odin the stock 4.4.2 rom
2)root from pc
3)replace the libWFDengine.so that i found from a thread
Click to expand...
Click to collapse
Hi kos25k!
Can you post here the link of your "libWFDengine.so" and what type of root method from pc you have used?
I have a Galaxy Tab 3 8.0 rooted too. I tried many methods read here on XDA but none with success.
I can only control my TV (Samsung UE32H6400) and send foto/music/video but I can't mirror the TV screen on my tablet..
THX

root with this method http://www.droidviews.com/root-galaxy-tab-3-8-0-sm-t310-on-kitkat/
then with a root explorer go to folder system>lib and replace the original libWFD_engine.so with this https://www.dropbox.com/s/c9lozyswxk84tyf/libWFD_ENGINE.so?dl=0 set permissions to rw-r-r and reboot.
Don't forget NOT to install a custom recovery!!!!!

Hi kos25k!
Thank you for your istructions. In the next days when I'll be at home again i'll test it and I will ppst my results. Ciao